The documentation; will answer your question: http://docs.splunk.com/Documentation/Splunk/5.0.6/Installation/HowtoupgradeSplunk when upgrading to 5.0.x, going from 4.2.x is a supported path. Going to 6.x you have to be on 4.3+. There is also a list of things to consider and warnings on back ups before you update. The subtopics will answer questions around upgrade order for distributed environments and/or the order of forwarder upgrades in relation to your servers. ... View more

I had 4.1.8 forwarders running for months against my 6.1.2 indexers without issue. But when I submitted an issue with a 4.n forwarder, Support wouldn't help because of the 4.n version. So I did the upgrade in three steps. 4.2, 5.0, 6.1.2. It was so easy I linked the 3 individual scripts so that one would call the other. The remaining servers were upgraded in minutes. Why wait? ... View more